Q: How can I make a service that normally runs in a shared SVCHOST instance run in its own SVCHOST instance?

A: Several services share SVCHOST instances. You can see this if you run

tasklist /svc

as shown below. Or you can right-click a SVCHOST process in Task Manager and select Go to Service(s).

svchost.exe                    324 AudioSrv, Dhcp, eventlog, lmhosts, wscsvcsvchost.exe                    488 AudioEndpointBuilder, CscService, hidserv,                                   Netman, PcaSvc, TabletInputService, TrkWks,                                   UxSms, WPDBusEnum, wudfsvcsvchost.exe                    540 BITS, Browser, CertPropSvc, EapHost, gpsvc,                                   hkmsvc, IKEEXT, iphlpsvc, LanmanServer,                                   MMCSS, ProfSvc, RasMan, Schedule, SENS,                                   ShellHWDetection, Themes, Winmgmt, wuauservwinlogon.exe                  1052 N/Asvchost.exe                   1212 EventSystem, netprofm, nsi, SstpSvc,                                   W32Time, WdiServiceHostPen_TouchService.exe          1308 TouchServicePensvchost.exe                   1456 CryptSvc, Dnscache, LanmanWorkstation,                                   napagent, NlaSvc, TapiSrvspoolsv.exe                   1608 Spoolersvchost.exe                   1644 FontCache, SCardSvr, SSDPSRV, upnphostsvchost.exe                   1676 BFE, DPS, MpsSvc

There might be times when, for troubleshooting or compatibility, you want to stop a service from sharing a SVCHOST instance. The SVCHOST groups are defined at HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost in the registry. You can create a new SVCHOST group in the registry with the name of the service and remove the service from the existing SVCHOST group.

You can also tell a service to run in its own process without having to create a new SVCHOST group. Navigate to the service's registry location, such as HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesThemes. Change the Type from decimal 32 to decimal 16. Once the system reboots, the service will run in its own SVCHOST processm as shown below. Note that Themes is now in its own SVCHOST process.

svchost.exe                    988 AudioSrv, Dhcp, eventlog, lmhostssvchost.exe                    372 AudioEndpointBuilder, CscService, PcaSvc,                                   SysMain, TrkWks, UmRdpService, UxSms,                                   WdiSystemHost, WPDBusEnumsvchost.exe                    444 Appinfo, BITS, Browser, CertPropSvc,                                   iphlpsvc, LanmanServer, MMCSS, ProfSvc,                                   Schedule, SENS, SessionEnv,                                   ShellHWDetection, Winmgmtsvchost.exe                    912 gpsvcsvchost.exe                    744 Themessvchost.exe                   1048 EventSystem, netprofm, nsi, W32Time,                                   WdiServiceHost, WinHttpAutoProxySvcsvchost.exe                   1176 CryptSvc, Dnscache, LanmanWorkstation,                                   NlaSvc, TermService